- NANOG - lists.nanog.org

Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Eugen Leitl 05 Sep '13

05 Sep '13

----- Forwarded message from liberationtech(a)lewman.us ----- Date: Wed, 4 Sep 2013 22:27:46 -0400 From: liberationtech(a)lewman.us To: liberationtech(a)lists.stanford.edu Subject: Re: [liberationtech] NSA Laughs at PCs, Prefers Hacking Routers and Switches Organization: The Tor Project, Inc. X-Mailer: Claws Mail 3.9.2 (GTK+ 2.24.20; x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> On Wed, 4 Sep 2013 20:33:09 -0400 Robert Guerra <rguerra(a)privaterra.org> wrote: > > Curious on people's comments on types of routers, firewalls and > other appliances that might be affected as well as mitigation > strategies. Would installing a pfsense and/or other open source > firewall be helpful in anyway at a home net location? When I read this article, I read core routers and switches at ISPs, like Cisco, Juniper, F5, etc. I don't read this as linksys, dlink, netgear, etc. I'm sure NSA could crack into anything consumer level with ease, it's likely any 4-bit criminal could do it too. However, it makes more sense for NSA to watch the core connectivity points on the Internet, rather than watching individuals, solely from an economic effort versus benefit point of view. When I ran global networks, one can record everything and sort out the individual streams later to find employees doing various layers of fraud or not. There was no point in watching the end points because it was too resource intensive. I'm sure the NSA has analyzed this and come to the same conclusion. There's no point in going after tens of millions of endpoints, when you can own them all with a handful of switches. A counterpoint is that most core Internet routers and switches are running at capacity and any monitoring affects quality of service and gets customers complaining. -- Andrew http://tpo.is/contact pgp 0x6B4D6475 -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

2 1

Re: Yahoo is now recycling handles
by Peter Kristolaitis 05 Sep '13

05 Sep '13

On 9/5/2013 1:20 AM, Larry Sheldon wrote: > On 9/4/2013 11:56 PM, Peter Kristolaitis wrote: >> On 9/5/2013 12:17 AM, Valdis.Kletnieks(a)vt.edu wrote: >>> On Wed, 04 Sep 2013 20:47:40 -0500, Leo Bicknell said: >>>> There's still the much more minor point that when I tried to "self >>>> serve" I ended up at a blank page on the Yahoo! web site, hopefully >>>> they >>>> will figure that out as well. >>> I'm continually amazed at the number of web designers that don't test >>> their pages with NoScript enabled. Just sayin'. >> >> NoScript? That's some kind of antimalvirus thingy for Internet >> Explorer, right? I think I read something about that in the Website >> Design For Dimwits in 24 Hours book... ;) > > I would not use IE on a bet, but I do use NoScript as well as several > other defensive weapons. > > I probably do not give a big rats patotie what your site offers--I > know it won't be good. > I assume that you intended this for the list and not me directly, and that you haven't yet got around to reading "Things To Experience On The Internet, Volume 1: Sarcasm". :) In case it wasn't abundantly clear, my post was a shot at what often passes for "web developer" these days. I had hoped that "antimalvirus" would have been an indication that it was a joke, but I guess my sarcasm is rusty... I would hope that no one on this list is ignorant of both the failings of IE and of the existence of NoScript.

1 0

Re: NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Scott Weeks 04 Sep '13

04 Sep '13

--- eugen(a)leitl.org wrote: From: Eugen Leitl <eugen(a)leitl.org> “No one updates their routers,” he says. “If you think people are bad about patching Windows and Linux (which they are) then they are … horrible about updating their networking gear because it is too critical, and usually they don’t have redundancy to be able to do it properly.” ------------------------------------------------------ So, they're saying upgrade to every new OS that comes out? Plus, isn't spelling a requirement for journalists these days??? "...patching Windows and Linux (which they are) then they are..." ------------------------------------------------------ Hijacking routers and switches could allow the NSA to do more than just eavesdrop on all the communications crossing that equipment. It would also let them bring down networks or prevent certain communication, such as military orders, from getting through, though the Post story doesn’t report any such activities. With control of routers, the NSA could re-route traffic to a different location, or intelligence agencies could alter it for disinformation campaigns, such as planting information that would have a detrimental political effect or altering orders to re-route troops or supplies in a military operation. ------------------------------------------ This is just confused, like much of the rest of the article. Mostly FUD with a small kernel of fact inside the FUD wrapper. scott

2 1

NSA Laughs at PCs, Prefers Hacking Routers and Switches
by Eugen Leitl 04 Sep '13

04 Sep '13

http://www.wired.com/threatlevel/2013/09/nsa-router-hacking/ NSA Laughs at PCs, Prefers Hacking Routers and Switches BY KIM ZETTER09.04.136:30 AM Photo: Santiago Cabezas/Flickr The NSA runs a massive, full-time hacking operation targeting foreign systems, the latest leaks from Edward Snowden show. But unlike conventional cybercriminals, the agency is less interested in hacking PCs and Macs. Instead, America’s spooks have their eyes on the internet routers and switches that form the basic infrastructure of the net, and are largely overlooked as security vulnerabilities. Under a $652-million program codenamed “Genie,” U.S. intel agencies have hacked into foreign computers and networks to monitor communications crossing them and to establish control over them, according to a secret black budget document leaked to the Washington Post. U.S. intelligence agencies conducted 231 offensive cyber operations in 2011 to penetrate the computer networks of targets abroad. This included not only installing covert “implants” in foreign desktop computers but also on routers and firewalls — tens of thousands of machines every year in all. According to the Post, the government planned to expand the program to cover millions of additional foreign machines in the future and preferred hacking routers to individual PCs because it gave agencies access to data from entire networks of computers instead of just individual machines. Most of the hacks targeted the systems and communications of top adversaries like China, Russia, Iran and North Korea and included activities around nuclear proliferation. The NSA’s focus on routers highlights an often-overlooked attack vector with huge advantages for the intruder, says Marc Maiffret, chief technology officer at security firm Beyond Trust. Hacking routers is an ideal way for an intelligence or military agency to maintain a persistent hold on network traffic because the systems aren’t updated with new software very often or patched in the way that Windows and Linux systems are. “No one updates their routers,” he says. “If you think people are bad about patching Windows and Linux (which they are) then they are … horrible about updating their networking gear because it is too critical, and usually they don’t have redundancy to be able to do it properly.” He also notes that routers don’t have security software that can help detect a breach. “The challenge [with desktop systems] is that while antivirus don’t work well on your desktop, they at least do something [to detect attacks],” he says. “But you don’t even have an integrity check for the most part on routers and other such devices like IP cameras.” Hijacking routers and switches could allow the NSA to do more than just eavesdrop on all the communications crossing that equipment. It would also let them bring down networks or prevent certain communication, such as military orders, from getting through, though the Post story doesn’t report any such activities. With control of routers, the NSA could re-route traffic to a different location, or intelligence agencies could alter it for disinformation campaigns, such as planting information that would have a detrimental political effect or altering orders to re-route troops or supplies in a military operation. According to the budget document, the CIA’s Tailored Access Programs and NSA’s software engineers possess “templates” for breaking into common brands and models of routers, switches and firewalls. The article doesn’t say it, but this would likely involve pre-written scripts or backdoor tools and root kits for attacking known but unpatched vulnerabilities in these systems, as well as for attacking zero-day vulnerabilities that are yet unknown to the vendor and customers. “[Router software is] just an operating system and can be hacked just as Windows or Linux would be hacked,” Maiffret says. “They’ve tried to harden them a little bit more [than these other systems], but for folks at a place like the NSA or any other major government intelligence agency, it’s pretty standard fare of having a ready-to-go backdoor for your [off-the-shelf] Cisco or Juniper models.” Not all of the activity mentioned in the budget document involved remote hacking. In some cases, according to the document, the operations involved clandestine activity by the CIA or military intelligence units to “physically place hardware implants or software modifications” to aid the spying. “Much more often, an implant is coded entirely in software by an NSA group called Tailored Access Operations (TAO),” the Post writes in its story about the document. “As its name suggests, TAO builds attack tools that are custom-fitted to their targets.” A handful of security researchers have uncovered vulnerabilities in routers in recent years that could be used to do the kind of hacking described in the budget document. In 2005, security researcher Mike Lynn found a serious vulnerability in Cisco IOS, the operating system running on millions of Cisco routers around the world. Lynn discovered the vulnerability after his employer, Internet Security Systems, asked him to reverse-engineer the Cisco operating system to see if he could find security problems with it. Cisco makes the majority of the routers that operate the backbone of the internet as well as many company networks and critical infrastructure systems. The Cisco IOS is as ubiquitous in the backbone as the Windows operating system is on desktops. The vulnerability Lynn found, in a new version of the operation system that Cisco planned to release at the time, would have allowed someone to create a router worm that would shut down every Cisco router through which it passed, bringing down a nation’s critical infrastructure. It also would have allowed an attacker to gain complete control of the router to sniff all traffic passing through a network in order to read, record or alter it, or simply prevent traffic from reaching its recipient. Once Lynn found the vulnerability, it took him six months to develop a working exploit to attack it. Lynn had planned to discuss the vulnerability at the Black Hat security conference in Las Vegas, until Cisco intervened and forced him to pull the talk under threat of a lawsuit. But if Lynn knew about the vulnerability, there were likely others who did as well — including intelligence agencies and criminal hackers. Source code for Cisco’s IOS has been stolen at least twice, either by entities who were interested in studying the software to gain a competitive advantage or to uncover vulnerabilities that would allow someone to hack or control them. Other researchers have uncovered different vulnerabilities in other Cisco routers that are commonly used in small businesses and home offices. Every year at computer security conferences — including the Black Hat conference where NSA Director Keith Alexander presented a keynote this year — U.S. intelligence agencies and contractors from around the world attend to discover information about new vulnerabilities that might be exploited and to hire talented researchers and hackers capable of finding more vulnerabilities in systems. In 2008, a researcher at Core Security Technologies developed a root kit for the Cisco IOS that was designed to give an attacker a persistent foothold on a Cisco router while remaining undetected. According to the Post story, the NSA designs most of the offensive tools it uses in its Genie operation, but it spent $25.1 million in one year for “additional covert purchases of software vulnerabilities” from private malware vendors who operate on the grey market — closed markets that peddle vulnerabilities and exploits to law enforcement and intelligence agencies, as opposed to the black market that sells them to cyber criminals. The price of vulnerabilities and exploits varies, depending on a number of factors. Vulnerabilities and exploits can sell for anywhere from $50,000 to more than a million, depending on the exclusivity of the purchase — some vulnerabilities are sold to multiple parties with the understanding that others are using it as well — and their ubiquity. A vulnerability that exists in multiple versions of an operating system is more valuable than a vulnerability that exists in just one version. A class of vulnerability that crosses multiple browser brands is also more valuable than a single vulnerability that just affects the Safari browser or Chrome. The Stuxnet cyber weapon that was reportedly created by the U.S. and Israel to sabotage centrifuges used in Iran’s uranium enrichment program, used five zero-day exploits to spread itself among systems in Iran, including a rare exploit that attacked the .LNK function in multiple versions of the Windows operating system in order to spread the worm silently via infected USB sticks. Ubiquitous router vulnerabilities are difficult to find since there are so many different configurations for routers, and an attack that works against one router configuration might not work for another. But a vulnerability that affects the core operating system is much more valuable since it is less likely to be dependent on the configuration. Maiffret says there hasn’t been a lot of public research on router vulnerabilities, but whenever someone has taken a look at them, they have found security holes in them. “They’re always successful in finding something,” he says. Once a vulnerability becomes known to the software maker and is patched, it loses a lot of its value. But because many users and administrators do not patch their systems, some vulnerabilities can be used effectively for years, even after a patch is available. The Conficker worm, for example, continued to infect millions of computers long after Microsoft released a patch that should have stopped the worm from spreading. Routers in particular often remain unpatched because system administrators don’t think they will be targeted and because administrators are concerned about network outages that could occur while the patch is applied or if the patch is faulty. Kim Zetter is a senior reporter at Wired covering cybercrime, privacy, security and civil liberties. Read more by Kim Zetter Follow @KimZetter and @ThreatLevel on Twitter.

1 0

10G Router
by sten rulz 04 Sep '13

04 Sep '13

Hello, I am currently looking into a 10G router that will support the below requirements and hopefully not be too costly. Do you know of any models to stay away due to issues or that you would recommend? - 4x+ 10GBE ports - BGPv4/v6 - Small number of RU preferred - Support for 2-4 full routing tables - 2 10GBE ports down to switches - 2 10GBE for up-streams but would prefer more to support IXs. I have been looking into a few options including; Brocade CER 2024C-4X, Broacde MLXE-4 with 10Gx8-X, Juniper MX80, Cumulus Linux, etc. Some quick notes: - 4x 10GBE ports is a bit low for the Brocade CER - Not sure how the CER will handle a few routing tables and 10G+ traffic - The MLX and MX80 is very high costs from what I have seen - The MX80 has 4x 10GBE ports but at less allows an extra 4 via MIC - Decent number of real use case reviews for the MX80 - Possibly use cumulus networks if there are any systems that meet the requirements Thanks Steven

7 6

Akamai Edgekey issues ?
by Jorge Amodio 04 Sep '13

04 Sep '13

Hi There, is anybody having any problems with sites that go through Akamai's CDN ? I'm having problems to connect to many served by them, just two examples. www.ti.com www.newark.com Cheers Jorge

6 9

Facebook over IPv6
by Blair Trosper 04 Sep '13

04 Sep '13

Could someone @ Facebook kindly drop me a line? Your site appears to be riddled with problems on the IPv6 side (whereas it's demonstrably fine on v4). Much of the static JavaScript content being served off your IPv6 CDN is corrupt, missing, or perhaps just outdated. It's preventing the page from doing anything but rendering...it has no interactivity. It's been this way about 24 hours now. Blair

1 0

Update on Mailman Outage from the NANOG Communications Committee
by Valerie Wittkop 03 Sep '13

03 Sep '13

Hello All, Just wanted to send you all a quick note regarding the mailman outage NANOG experienced this weekend... A couple of changes made in August on the server resulted in an issue when the new month arrived. We have found the issue, fixed, and now have everything up and running properly again. Lists are working as they should and the web user interface is available should you wish to make any changes to your subscription. We apologize for the interruption, and should you experience any other problems/issues, please let us know by sending a message to admins(a)nanog.org. Cheers, Valerie Wittkop On behalf of the NANOG Communications Committee

1 0

Having dropped packets when reaching Cogent Network
by John-Pierre Atallah 03 Sep '13

03 Sep '13

Hello, If anyone is from Cogent, can you email me off list. I'm having a problem reaching a website when going through Cogent hops. Looking for any help, thank you! -John-Pierre

1 0

Re: TCP Performance
by Nick Olsen 03 Sep '13

03 Sep '13

I have indeed tried that. And it didn't make any difference. Functionally limiting each router port to is connected microwave links capacity. And queuing the overflow. However the queue never really fills as the traffic rate never goes higher then the allocated bandwidth. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Blake Dunlap" <ikiris(a)gmail.com> Sent: Tuesday, August 27, 2013 1:32 PM To: nick(a)flhsi.com Cc: "Tim Warnock" <timoid(a)timoid.org>, "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: Re: TCP Performance If you have a router, you can turn on shaping to the bandwidth the link will support. -Blake On Tue, Aug 27, 2013 at 12:11 PM, Nick Olsen <nick(a)flhsi.com> wrote: I do indeed have stats for "TX Pause Frames" And they do increment. However, Our router is ignoring them since it doesn't support flow control. I guess my next question would be. In the scenario where we insert a switch between the radio and the router that does support flow control. Are we not only moving where the overflow is going to occur? Will we not see the router still burst traffic at line rate toward the switch, Which then buffer overflows sending to the radio on account of it receiving pause frames? Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Tim Warnock" <timoid(a)timoid.org> Sent: Tuesday, August 27, 2013 1:08 PM To: "Blake Dunlap" <ikiris(a)gmail.com>, "nick(a)flhsi.com" <nick(a)flhsi.com> Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: RE: TCP Performance > Regardless, your problem looks like either tail drops or packet loss, which > you showed originally. The task is to find out where this is occurring, and > which of the two it is. If you want to confirm what is going on, there are > some great bandwidth calculators on the internet which will show you what > bandwidth you can get with a given ms delay and % packet loss. > > As far as flow control, its really outside the scope. If you ever need flow > control, there is usually a specific reason like FCoE, and if not, it's > generally better to just fix the backplane congestion issue if you can, > than ever worry about using FC. The problem with FC isn't node to node, its > when you have node to node to node with additional devices, it isn't smart > enough to discriminate, and can crater your network 3 devices over when it > would be much better to just lose a few packets. > > -Blake In my experience - if you're traversing licenced microwave links as indicated flow control will definitely need to be ON. Check the radio modem stats to confirm but - if you're seeing lots of drops there you're overflowing the buffers on the radio modem.

2 2